CVE-2025-46513: Time Clock Lite CSRF Vulnerability

CVE-2025-46513 Overview

CVE-2025-46513 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Codebangers All in One Time Clock Lite WordPress plugin (aio-time-clock-lite). The flaw affects all plugin versions up to and including 1.3.326. An attacker can craft a malicious web page that triggers unauthorized state-changing requests when an authenticated user visits it. Exploitation requires user interaction, and the attack is delivered over the network. The vulnerability impacts integrity but does not directly expose confidential data or affect availability.

Critical Impact
Attackers can force authenticated WordPress users to perform unintended actions within the All in One Time Clock Lite plugin by luring them to a crafted page.

Affected Products

Codebangers All in One Time Clock Lite (aio-time-clock-lite) versions up to and including 1.3.326
WordPress installations with the vulnerable plugin activated
Sites where administrators or authenticated users interact with untrusted external content

Discovery Timeline

2025-04-24 - CVE-2025-46513 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46513

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF protections in the All in One Time Clock Lite plugin. WordPress plugins are expected to validate a nonce (wp_verify_nonce) or an equivalent token on state-changing requests. When these controls are absent, browsers automatically attach the authenticated user's session cookies to cross-origin requests initiated from attacker-controlled pages. The plugin then processes those requests as legitimate actions performed by the logged-in user.

An attacker crafts a malicious HTML page containing a form or JavaScript that submits requests to a vulnerable plugin endpoint. When an authenticated WordPress user visits that page, the browser issues the request with valid session credentials. The plugin executes the action without confirming the request originated from the WordPress admin interface.

The EPSS score of 0.128% reflects a low current probability of active exploitation. However, CSRF flaws in WordPress plugins are commonly weaponized through phishing and social engineering campaigns targeting site administrators.

Root Cause

The root cause is missing origin validation on privileged plugin actions. The plugin does not enforce nonce checks that would tie a request to a specific user session and admin page context. Requests originating from any domain succeed as long as the user is authenticated to the WordPress site.

Attack Vector

The attack requires an authenticated victim to visit an attacker-controlled URL. The exploit page contains automatic form submissions or XMLHttpRequest calls pointing at the vulnerable plugin endpoint. No credentials or privileges are required from the attacker. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-46513

Indicators of Compromise

Unexpected changes to All in One Time Clock Lite plugin settings or time clock records with no corresponding admin activity in audit logs
HTTP POST requests to aio-time-clock-lite plugin endpoints with Referer or Origin headers pointing to external domains
Authenticated administrator sessions generating requests immediately after visiting external links from email or messaging platforms

Detection Strategies

Enable WordPress audit logging to record all plugin configuration changes and correlate them with user session activity
Inspect webserver access logs for POST requests to plugin URLs lacking a valid same-origin Referer header
Alert on plugin action requests missing the expected _wpnonce parameter

Monitoring Recommendations

Monitor administrator accounts for browsing activity followed by unexpected plugin state changes
Review WordPress user activity logs weekly for anomalous configuration modifications
Track outbound admin traffic patterns and flag session behavior inconsistent with routine administrative workflows

How to Mitigate CVE-2025-46513

Immediate Actions Required

Update the All in One Time Clock Lite plugin to a version later than 1.3.326 once released by the vendor
Deactivate the plugin on production sites until a patched release is available if the plugin is not business-critical
Require administrators to log out of the WordPress admin interface when browsing untrusted content

Patch Information

At the time of NVD publication, the advisory identifies all versions through < 1.3.326 as vulnerable. Consult the Patchstack Vulnerability Report for the latest fixed version information and vendor guidance.

Workarounds

Deploy a web application firewall (WAF) rule that blocks requests to plugin endpoints when the Referer or Origin header does not match the site domain
Restrict WordPress administrator access to dedicated browsers or browser profiles used exclusively for site management
Enforce two-factor authentication for privileged WordPress accounts to reduce the value of hijacked sessions
Apply least-privilege role assignments so that only necessary users hold accounts capable of triggering plugin actions

bash

# Example: Apache mod_rewrite rule to reject cross-origin POST requests to the plugin
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} /wp-content/plugins/aio-time-clock-lite/ [NC]
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com/ [NC]
RewriteRule .* - [F,L]